The information and knowledge created and accumulated by organizations and businesses are their most valuable assets. As such, managing and keeping the information and the knowledge inside the organization and restricting its distribution outside are of paramount importance for almost any organization, government entity or business, and provide a significant leverage of its value. Most of the information in modern organizations and businesses is represented in a digital format. Digital content can be easily copied and distributed (e.g., via e-mail, instant messaging, peer-to-peer networks, FTP and web-sites), which greatly increases hazards such as business espionage and data leakage. In addition, the distribution of digital items requires resources, such as costly bandwidth and precious employee time. Unauthorized dissemination of information therefore poses a severe risk from both business and legal perspectives. However, events of unauthorized dissemination of information, especially via e-mail, are prevalent and happen in large organizations almost on a daily basis.
Another aspect of the problem is related to compliance with regulations pertaining to private and sensitive information: Regulations within the United States of America, such as the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley act (GLBA) and the privacy-protecting laws of various states and nations imply that the information assets within organizations should be monitored and subjected to an information protection policy, in order to protect clients privacy and to mitigate the risks of potential misuse and fraud.
A popular method for preventing information leakage is to inspect and monitor the digital traffic, e.g., using the method described in U.S. Patent Application Publication No. 2002/0129140, filed Dec. 6, 2001, the contents of which are hereby incorporated herein by reference in their entirety, and to use information filters, such as regular expressions, in order to identify patterns of private information, such as social security numbers. However, filtering methods and techniques comprise an inherent problem of false alarms and miss-detections, respectively known as false positive and false negative errors. In order to make such methods effective, it is imperative to provide an efficient method for false positive mitigation.
There is thus a recognized need for, and it would be highly advantageous to have, a method and system that allow for mitigation of false indications of unauthorized dissemination of private, confidential or sensitive information in a digital traffic filtering system, which will overcome the drawbacks of current methods as described above.